C# Syntax error (missing operator) in query expression

Question

I receive this error on cmd.ExecuteNonQuery()... I think I am wrong on cmd.CommandText...

Syntax error (missing operator) in query expression 'Nr_Crt='1' and Varsta '3' and KG '2' and Specie 'Iepure' and Risc'Nu' and Tip1 'Diurn' and Tip2 'Carnivor''.

    private void button2_Click_1(object sender, EventArgs e)
        {
            if (txtNr_Crt.Text != " " & txtVarsta.Text != " " & txtKG.Text != " " & txtSpecie.Text != " " & txtRisc.Text != " " & txtTip1.Text != " " & txtTip1.Text != " " & txtTip2.Text != "")
            {

                cn.Open();
                cmd.CommandText = "DELETE from Animale Where Nr_Crt='" + txtNr_Crt.Text + "' and Varsta '" + txtVarsta.Text + "' and KG '" + txtKG.Text + "' and Specie '" + txtSpecie.Text + "' and Risc'" + txtRisc.Text + "' and Tip1 '" + txtTip1.Text + "' and Tip2 '" + txtTip2.Text + "'";
                cmd.ExecuteNonQuery();
                cn.Close();

                loaddata();

                txtNr_Crt.Text = "";
                txtVarsta.Text = "";
                txtKG.Text = "";
                txtSpecie.Text = "";
                txtSex.Text = "";
                txtRisc.Text = "";
                txtTip1.Text = "";
                txtTip2.Text = "";
            }
        }

Hello SQL injection! And you are missing the = from the rest of the query — DGibbs
– DGibbs, Commented Dec 5, 2013 at 12:24
Please use parameterized queries. This kind of string concatenations are open for SQL Injection attacks. — Soner Gönül
– Soner Gönül, Commented Dec 5, 2013 at 12:25

DGibbs · Accepted Answer · 2013-12-05 12:34:14Z

1

You code is vulnerable to SQL injection, i'd fix that.

The issue is that you are missing the = from each of your subsequent and's:

cn.Open();

cmd.Parameters.AddWithValue("@Nr_Crt", txtNr_Crt.Text);  
cmd.Parameters.AddWithValue("@Varsta", txtVarsta.Text);  
cmd.Parameters.AddWithValue("@KG", txtKG.Text);  
cmd.Parameters.AddWithValue("@Specie", txtSpecie.Text);  
cmd.Parameters.AddWithValue("@Risc", txtRisc.Text);  
cmd.Parameters.AddWithValue("@Tip1", txtTip1.Text);  
cmd.Parameters.AddWithValue("@Tip2", txtTip2.Text);  
cmd.CommandText = "DELETE from Animale Where Nr_Crt= @Nr_Crt and Varsta = @Varsta and KG = @KG and Specie = @Specie and Risc = @Risc and Tip1 = @Tip1 and Tip2 = @Tip2";

cmd.ExecuteNonQuery();
cn.Close();

This should fix it (and the SQL injection risk)

answered Dec 5, 2013 at 12:34

DGibbs

14.7k7 gold badges49 silver badges89 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

user3061587 Over a year ago

Fixed, but not delete anything from database, and listbox.

DGibbs Over a year ago

You probably have other issues with your code, are you rebinding the listbox? Put the code in a try/catch block, does it throw any exceptions?

user3061587 Over a year ago

I have an listbox for every Parameter and when I select first Paramater from first listbox, it`s select all first Paramaters and I want to delete all, or first line.

user2509901 · Accepted Answer · 2013-12-05 12:25:07Z

0

Your query is wrong. You are missing = when comparing the columns

cmd.CommandText = "DELETE from Animale Where Nr_Crt='" + txtNr_Crt.Text + "' and Varsta='" + txtVarsta.Text + "' and KG='" + txtKG.Text + "' and Specie='" + txtSpecie.Text + "' and Risc='" + txtRisc.Text + "' and Tip1='" + txtTip1.Text + "' and Tip2='" + txtTip2.Text + "'";

answered Dec 5, 2013 at 12:25

user2509901

Comments

Jay Harris · Accepted Answer · 2016-12-26 23:27:27Z

0

foreach(Control ctrl in this.Controls)
{
    if (ctrl is TextBox)
    {
      ctrl.text="";
    }
}

For cleaning all textbox at once :) you can create a Method that performs it when you need it

edited Dec 26, 2016 at 23:27

Jay Harris

10.1k1 gold badge28 silver badges28 bronze badges

answered Dec 26, 2016 at 22:46

Carlos Martinez

11 bronze badge

Collectives™ on Stack Overflow

C# Syntax error (missing operator) in query expression

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related